type=DAEMON_START msg=audit(1301050979.153:5202): auditd start, ver=2.0.6 format=raw kernel=2.6.32-71.18.2.el6.i686 auid=0 pid=21017 subj=unconfined_u:system_r:auditd_t:s0 res=success
type=CONFIG_CHANGE msg=audit(1301050979.298:32548): auid=0 ses=1840 subj=unconfined_u:system_r:auditctl_t:s0 op="remove rule" key=(null) list=4 res=1
type=CONFIG_CHANGE msg=audit(1301050979.304:32549): audit_backlog_limit=320 old=256 auid=0 ses=1840 subj=unconfined_u:system_r:auditctl_t:s0 res=1
type=DAEMON_END msg=audit(1301051019.682:5203): auditd normal halt, sending auid=0 pid=21045 subj=unconfined_u:system_r:initrc_t:s0 res=success
type=DAEMON_START msg=audit(1301051019.883:8518): auditd start, ver=2.0.6 format=raw kernel=2.6.32-71.18.2.el6.i686 auid=0 pid=21063 subj=unconfined_u:system_r:auditd_t:s0 res=success
type=CONFIG_CHANGE msg=audit(1301051020.085:32552): audit_enabled=1 old=1 auid=0 ses=1840 subj=unconfined_u:system_r:auditd_t:s0 res=1
type=CONFIG_CHANGE msg=audit(1301051020.124:32553): audit_backlog_limit=320 old=320 auid=0 ses=1840 subj=unconfined_u:system_r:auditctl_t:s0 res=1
type=USER_LOGIN msg=audit(1301051030.150:32554): user pid=21084 uid=0 auid=0 ses=44 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login acct="me" exe="/usr/sbin/sshd" hostname=? addr=::1 terminal=sshd res=failed'
type=USER_ERR msg=audit(1301051031.080:32555): user pid=21084 uid=0 auid=0 ses=44 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:bad_ident acct="?" exe="/usr/sbin/sshd" hostname=localhost addr=::1 terminal=ssh res=failed'
type=DAEMON_END msg=audit(1301051034.773:8519): auditd normal halt, sending auid=0 pid=21100 subj=unconfined_u:system_r:initrc_t:s0 res=success
type=DAEMON_START msg=audit(1301051034.966:7864): auditd start, ver=2.0.6 format=raw kernel=2.6.32-71.18.2.el6.i686 auid=0 pid=21118 subj=unconfined_u:system_r:auditd_t:s0 res=success
type=CONFIG_CHANGE msg=audit(1301051035.167:32558): audit_enabled=1 old=1 auid=0 ses=1840 subj=unconfined_u:system_r:auditd_t:s0 res=1
type=CONFIG_CHANGE msg=audit(1301051035.204:32559): audit_backlog_limit=320 old=320 auid=0 ses=1840 subj=unconfined_u:system_r:auditctl_t:s0 res=1
type=USER_AUTH msg=audit(1258740386.638:288): user pid=28360 uid=500 auid=500 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/libexec/polkit-1/polkit-agent-helper-1" hostname=? addr=? terminal=? res=failed'